NTFS Master File Table ($MFT)
| Format | NTFS Master File Table ($MFT) |
|---|---|
| Short name | $MFT |
| Category | filesystem |
| Platforms | Windows |
| Crush support | Not yet supported |
| Status | Reviewed |
| Last reviewed | 2026-10-04 |
Forensic relevance
The NTFS metadata file holding one 1 KiB (sometimes 4 KiB) record per file and directory, often exported on its own for triage. Each record has the $STANDARD_INFORMATION and $FILE_NAME timestamps, names, parent reference, size and the data runs or resident data. Records of deleted files stay until reused. A stand-alone $MFT contains resident data only; non-resident file content and the rest of the filesystem are not included.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 0 (0x0) | 46 49 4C 45 30 00 | FILE0. | MFT entry signature 'FILE' with fixup offset 0x30 (NTFS 3.1, Windows XP and later) |
| offset 0 (0x0) | 46 49 4C 45 2A 00 | FILE*. | MFT entry signature 'FILE' with fixup offset 0x2A (NTFS 3.0 and earlier) |
Known extensions
None recorded
References
- New Technologies File System (NTFS) — format documentation (libyal/libfsntfs) https://github.com/libyal/libfsntfs/blob/main/documentation/New%20Technologies%20File%20System%20(NTFS).asciidoc
- ForensicsWiki — $MFT https://forensics.wiki/$mft/
Cite this entry
Crush Format Reference, “NTFS Master File Table ($MFT)”. https://kalink0.github.io/crush-forensics/formats/mft/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction